diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-06-07 20:50:38 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-08-13 13:08:57 +0200 |
| commit | a004e2e4f138b775d3352c6857f8121818cba917 (patch) | |
| tree | 719230cfd70354a371783291e79a6b3320882e52 | |
| parent | f50f7adf7a9a4c71b2970e231202d453ef80263b (diff) | |
| download | ffmpeg-a004e2e4f138b775d3352c6857f8121818cba917.tar.gz | |
avcodec/alsdec: Check r to prevent out of array read
No testcase known
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c36fc857b5a8f8bdf2bcc54ce72bbf817902edcf)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/alsdec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index 8283b79760..d2c3485ee6 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -767,6 +767,11 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) r = get_unary(gb, 0, 4); c = get_bits(gb, 2); + if (r >= 4) { + av_log(avctx, AV_LOG_ERROR, "r overflow\n"); + return AVERROR_INVALIDDATA; + } + bd->ltp_gain[2] = ltp_gain_values[r][c]; bd->ltp_gain[3] = decode_rice(gb, 2) << 3; |